Jens/geointel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: prepare repository for public release

Browse Source
This commit is contained in:
Jens
2026-08-31 07:23:03 +02:00
parent 03df2db8b6
commit e43d7aca68
164 changed files with 694 additions and 29691 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/AI_PIPELINES.md
+10 -10
View File
@@ -234,7 +234,7 @@ does not download weights or accept arbitrary model paths from the browser.
Operational runtime validation can be run against Docker/Tower with:
```bash
bash scripts/verify_model_asset_detection_workflow.sh http://192.168.10.150:1202
bash scripts/verify_model_asset_detection_workflow.sh http://192.0.2.10:1202
```
The smoke seeds the explicit offline demo raster, creates a tile manifest,
@@ -267,7 +267,7 @@ demo fixtures:
```bash
REAL_RASTER_PATH=/mnt/user/appdata/geointel/data/orthophoto.tif \
REAL_REFERENCE_VECTOR_PATH=/mnt/user/appdata/geointel/data/reference-buildings.geojson \
bash scripts/verify_real_data_detection_qa_workflow.sh http://192.168.10.150:1202
bash scripts/verify_real_data_detection_qa_workflow.sh http://192.0.2.10:1202
```
The script verifies the full persisted chain:
@@ -333,7 +333,7 @@ For confidence-threshold calibration, use the sweep wrapper:
REAL_RASTER_PATH=/mnt/user/appdata/geointel/storage/operator-data/geel_orthophoto_wms_512.tif \
REAL_REFERENCE_VECTOR_PATH=/mnt/user/appdata/geointel/storage/operator-data/geel_grb_gbg_buildings.geojson \
CALIBRATION_THRESHOLDS="0.50 0.35 0.25 0.15" \
bash scripts/run_detection_calibration_sweep.sh http://192.168.10.150:1202
bash scripts/run_detection_calibration_sweep.sh http://192.0.2.10:1202
```
The sweep runs the real-data workflow once per threshold and then reads the
@@ -354,7 +354,7 @@ QUALITY_MODEL_ASSET_IDS="yolov8n-building-segmentation-pt yolov8n-pt" \
QUALITY_TILE_SIZES="512 640" \
QUALITY_TILE_OVERLAPS="64" \
QUALITY_THRESHOLDS="0.50 0.15" \
bash scripts/run_detection_quality_matrix.sh http://192.168.10.150:1202
bash scripts/run_detection_quality_matrix.sh http://192.0.2.10:1202
```
The matrix repeats the same persisted real-data workflow for every combination
@@ -374,7 +374,7 @@ QUALITY_TILE_SIZES="512" \
QUALITY_TILE_OVERLAPS="64" \
QUALITY_THRESHOLDS="0.35 0.15" \
BACKGROUND_SPLIT_OUTPUT_DIR=artifacts/detection-hard-negatives/aoi1024bg512r3e50-split \
bash scripts/run_background_corpus_split_matrix.sh http://192.168.10.150:1202
bash scripts/run_background_corpus_split_matrix.sh http://192.0.2.10:1202
```
The split runner writes `background_corpus_split_summary.json` and Markdown
@@ -410,7 +410,7 @@ QUALITY_TILE_OVERLAPS="64" \
QUALITY_THRESHOLDS="0.35 0.15" \
BACKGROUND_SPLIT_OUTPUT_DIR=artifacts/detection-hard-negatives/aoi1024bg512r3e50-split \
PROMOTION_OUTPUT_DIR=artifacts/detection-model-promotion/aoi1024bg512r3e50-split-aware \
bash scripts/run_split_background_promotion_workflow.sh http://192.168.10.150:1202
bash scripts/run_split_background_promotion_workflow.sh http://192.0.2.10:1202
```
The wrapper keeps the same safety boundary: existing dataset upload, configured
@@ -430,7 +430,7 @@ samples with persisted reference features, matching the matrix runner.
```bash
PROMOTION_POSITIVE_PORTFOLIO_PATH=artifacts/detection-quality-matrix/multi-sample/aoi1024bg512r3e50-positive/multi_sample_quality_summary.json \
OPERATOR_SAMPLE_MANIFEST_PATH=storage/operator-data/operator_samples_manifest.json \
bash scripts/run_split_background_promotion_workflow.sh --preflight-only http://192.168.10.150:1202
bash scripts/run_split_background_promotion_workflow.sh --preflight-only http://192.0.2.10:1202
```
The underlying single-category matrix remains available:
@@ -443,7 +443,7 @@ QUALITY_MODEL_ASSET_IDS="geointel-building-yolov8n-expanded160e50-pt geointel-bu
QUALITY_TILE_SIZES="640" \
QUALITY_TILE_OVERLAPS="64" \
QUALITY_THRESHOLDS="0.25 0.15 0.05" \
bash scripts/run_operator_hard_negative_detection_matrix.sh http://192.168.10.150:1202
bash scripts/run_operator_hard_negative_detection_matrix.sh http://192.0.2.10:1202
```
The hard-negative matrix uploads only background rasters and counts detections
@@ -546,7 +546,7 @@ QUALITY_MODEL_ASSET_IDS="yolov8n-building-segmentation-pt yolov8n-pt" \
QUALITY_TILE_SIZES="512 640" \
QUALITY_TILE_OVERLAPS="64" \
QUALITY_THRESHOLDS="0.50 0.15" \
bash scripts/run_multi_sample_detection_quality_matrix.sh http://192.168.10.150:1202
bash scripts/run_multi_sample_detection_quality_matrix.sh http://192.0.2.10:1202
```
The multi-sample summary exposes `best_overall_by_score`,
@@ -622,7 +622,7 @@ summary:
```bash
CALIBRATION_SUMMARY_PATH=/mnt/user/appdata/geointel/artifacts/detection-calibration/20260707T002103Z/calibration_summary.json \
bash scripts/export_detection_calibration_evidence.sh http://192.168.10.150:1202
bash scripts/export_detection_calibration_evidence.sh http://192.0.2.10:1202
```
The evidence bundle calls
docs/API_CONTRACTS.md
+14 -7
View File
@@ -47,9 +47,11 @@ Any valid GeoJSON geometry object. V1 primarily expects `Polygon` and `MultiPoly
## Operator authentication and guest demo
Authentication remains an optional single-operator access gate, not multi-user
account management or tenant isolation. When `GEOINTEL_AUTH_ENABLED=true`,
every `/api/v1/*` request except the four authentication endpoints below
Authentication remains an optional single-operator access gate for local
development and is enabled by default in the packaged Unraid runtime; it is not
multi-user account management or tenant isolation. When
`GEOINTEL_AUTH_ENABLED=true`, every `/api/v1/*` request except the six
authentication routes below
requires a valid signed `geointel_session` cookie. Missing, expired or modified
sessions return HTTP 401 with `AUTHENTICATION_REQUIRED`. Direct loopback calls
to the backend without proxy headers remain available to trusted in-container
@@ -57,9 +59,12 @@ operator tools; the backend is bound to loopback in the all-in-one runtime.
The runtime stores only a PBKDF2-SHA256 operator password hash and an
independent session-signing secret. The browser receives an HttpOnly,
SameSite=Strict, time-limited cookie. Five failed operator-login attempts for
one client/username combination within five minutes temporarily return HTTP
429 `LOGIN_RATE_LIMITED`.
SameSite=Strict, time-limited cookie. Packaged deployments also set
`GEOINTEL_AUTH_REQUIRE_HTTPS=true`; plaintext password login then returns HTTP
426 `AUTH_HTTPS_REQUIRED`. Five failed operator-login attempts for one resolved
client/username combination within five minutes temporarily return HTTP 429
`LOGIN_RATE_LIMITED`. Forwarded client addresses are accepted only from the
loopback or container-proxy networks used by the shipped nginx topology.
Optional guest access is a configuration-gated demonstration mode. It creates
a shorter signed session with role `guest`, scopes that session to the
@@ -72,6 +77,7 @@ management, uploads, source/runtime configuration, evidence review and other
administrative mutations remain unavailable. This is deliberately **not**
a substitute for user accounts, authorization or tenant isolation; expose it
only on a dedicated demo installation without private or operational data.
Guest access defaults off and must be enabled explicitly.
The functional demo boundary includes bounded, project-path-scoped official
source acquisition, persisted bbox selections, temporal comparisons and change
@@ -131,7 +137,8 @@ return `role: "guest"` and the UUID of their bound demo project in
Successful login sets the session cookie and returns the authenticated session
shape. Invalid credentials return HTTP 401 `INVALID_CREDENTIALS`; username
existence is not disclosed.
existence is not disclosed. When HTTPS is required, a plaintext request returns
HTTP 426 `AUTH_HTTPS_REQUIRED` before credentials are evaluated.
### GET `/api/v1/auth/authentik/start`
docs/BUILD_STATUS.md
+1 -1
View File
@@ -70,5 +70,5 @@ Live release evidence:
python scripts/capture_release_evidence.py \
--output storage/release-evidence/rc-current/baseline.json \
--release-id rc-belgium-north-sea \
--live-base-url http://192.168.10.150:1202
--live-base-url http://192.0.2.10:1202
```
docs/CODEX_EXECUTION_LOG.md
+277 -238
View File
File diff suppressed because it is too large Load Diff
docs/ENVIRONMENT_SPEC.md
+1 -1
View File
@@ -98,7 +98,7 @@ bash scripts/verify_gis_runtime.sh http://localhost:1202
```
For a LAN deployment, replace the URL with the published host address, for
example `http://192.168.10.150:1202`.
example `http://192.0.2.10:1202`.
## Local development commands
docs/POST_RC_DATA_COVERAGE_ROADMAP_BELGIUM_NORTH_SEA.md
+2 -2
View File
@@ -56,9 +56,9 @@ When Docker/Tower is available:
```bash
docker compose config
curl --fail http://192.168.10.150:1202/health/ready
curl --fail http://192.0.2.10:1202/health/ready
bash scripts/run_rc8_release_journeys.sh \
http://192.168.10.150:1202 \
http://192.0.2.10:1202 \
artifacts/post-rc-release-journeys \
artifacts/post-rc-golden-areas.json
```
docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md
+4 -4
View File
@@ -113,9 +113,9 @@ When Tower is reachable:
Then verify:
```bash
curl -fsS http://192.168.10.150:1202/health/live
curl -fsS http://192.168.10.150:1202/health/ready
curl -fsS http://192.168.10.150:1202/api/v1/system/capabilities
curl -fsS http://192.0.2.10:1202/health/live
curl -fsS http://192.0.2.10:1202/health/ready
curl -fsS http://192.0.2.10:1202/api/v1/system/capabilities
```
The in-app browser acceptance must cover desktop, widescreen and a narrow
@@ -464,7 +464,7 @@ contains no unexpected browser-console or failed-request events.
```bash
npm --prefix frontend run test:unit
bash scripts/run_rc8_release_journeys.sh \
http://192.168.10.150:1202 \
http://192.0.2.10:1202 \
artifacts/rc8-release-journeys \
artifacts/rc8-golden-areas.json
```
docs/TODO.md
+15
View File
@@ -1,5 +1,20 @@
# GeoIntel TODO
## Publieke repository (2026-08-31)
- [x] Integreer de actuele release-hygiënetak vanaf `origin/main` zonder de
private Tower-handoff of ongerelateerde DockDeck/Stitch-geschiedenis.
- [x] Verwijder lokale databases, Codex-input, browserlogs en lokale MCP-config
uit de getrackte publicatieboom en borg dit in de releasegate.
- [x] Maak de verpakte authenticatie-, HTTPS-, gast- en checkpointdefaults
fail-closed.
- [ ] Kies en voeg een rootlicentie toe.
- [ ] Kies tussen een gecontroleerde history rewrite/force-push van alle
publieke refs en een nieuwe schone publieke repository; voer dit pas uit na
expliciete eigenaarstoestemming.
- [ ] Verwijder na die keuze de volledig gemergde of aantoonbaar achterhaalde
remote branches zodat geen private historische blobs publiek bereikbaar zijn.
## Accuracy-remediatie (2026-08-30)
- [x] Herhaal de lokale Phase-3-scan deterministisch: scan
docs/UX_PERFORMANCE_BUDGETS.md
+1 -1
View File
@@ -39,7 +39,7 @@ its budget must display the measured duration and budget warning.
```bash
npm --prefix frontend run test:unit
bash scripts/run_rc9_ux_audit.sh \
http://192.168.10.150:1202 \
http://192.0.2.10:1202 \
artifacts/rc9-ux-audit
```
docs/UX_PREMIUM_ATLAS_PASS_2026-07-26.md
+1 -1
View File
@@ -36,4 +36,4 @@ The new layer lives in `frontend/src/styles/atlas-premium-v2.css` and loads afte
Commit `d5ea270` accidentally overlaid DockDeck root/runtime files onto GeoIntel. This pass restores every path touched by that overlay to the last clean GeoIntel revision (`9db6cca`) while retaining the intended GeoIntel frontend work. The authoritative remote remains `git@gitea.itworx.tech:Jens/geointel.git`.
The Tower deployment key default is now `$HOME/.ssh/itworx_unraid_deploy`, the repository default is `Jens/geointel`, and PowerShell-to-Bash script transfer normalizes line endings to LF.
The Tower deployment key default is now `$HOME/.ssh/geointel_unraid_deploy`, the repository default is `Jens/geointel`, and PowerShell-to-Bash script transfer normalizes line endings to LF.
docs/superpowers/plans/2026-07-06-model-reference-catalog.md
+2 -2
View File
@@ -403,8 +403,8 @@ bash ../scripts/live_migration_smoke.sh
Call:
```bash
curl http://192.168.10.150:1202/api/v1/detection/model-assets
curl "http://192.168.10.150:1202/api/v1/detection/yolo/preflight?model_asset_id=<asset>&tile_manifest_path=<manifest>"
curl http://192.0.2.10:1202/api/v1/detection/model-assets
curl "http://192.0.2.10:1202/api/v1/detection/yolo/preflight?model_asset_id=<asset>&tile_manifest_path=<manifest>"
```
Expected: canonical envelopes and no model downloads.